TerriaJS-Server tiene una vulnerabilidad de omisión de validación de dominio en su lista de permitidos de proxy.

An attacker can exploit this vulnerability by registering a malicious domain (e.g., maliciousexample.com) and then proxying content through the vulnerable terrajs-server instance. Because the validation only checks for a suffix match, maliciousexample.com would be incorrectly considered allowed if example.com is in the proxyableDomains configuration. This bypasses intended proxy restrictions, potentially leading to data exposure, malicious content delivery, and unauthorized access to internal resources. The blast radius extends to any users or systems relying on terrajs-server for proxying, particularly those with sensitive data or critical services.

Organizations using terrajs-server for proxying web traffic, particularly those with sensitive data or critical services, are at risk. Shared hosting environments where multiple users share a terrajs-server instance are also particularly vulnerable, as a compromise of one user's account could potentially affect others.

• nodejs / server:

  ps aux | grep terrajs-server

• nodejs / server:

  find / -name "proxyableDomains" -type f

• generic web: Check terrajs-server logs for requests to unexpected or unauthorized domains. Look for patterns indicating proxy bypass attempts. • generic web: Review terrajs-server configuration files for overly permissive proxyableDomains settings.

1. 2026-02-26Disclosure

   disclosure

1. Reservado2026-02-24
2. Publicada2026-02-26
3. EPSS actualizado2026-03-23

The primary mitigation is to upgrade terrajs-server to version 4.0.3 or later, which includes the corrected validation logic. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests to unexpected or unauthorized domains. Additionally, carefully review and restrict the proxyableDomains configuration to only include explicitly trusted domains. Regularly audit proxy configurations to ensure they align with security policies. After upgrading, confirm the fix by attempting to proxy a domain not explicitly listed in proxyableDomains and verifying that the request is blocked.